YesWiki EUVD-2026-91395

No special configuration is required beyond running an affected YesWiki version (any release before 4.6.7) that serves attachments on read-restricted pages; exploitation works against default deployments where page-level read ACLs are relied upon to protect uploaded files. The attacker must know or enumerate two values: the target page's tag and the specific file parameter (attachment name), since the download handler is requested directly with these. The practical limiting factor is this knowledge requirement - attachments on pages whose tag and file names are unknown and non-guessable are harder to retrieve - but there is no authentication, privilege, or user-interaction barrier.

This is a credible, actionable priority rather than a merely high-scoring paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable flaw that requires no authentication, no privileges, no user interaction and no special attack prerequisites, with a high confidentiality impact (VC:H) and no integrity or availability impact - fully consistent with the description of an unauthenticated ACL bypass that leaks confidential attachments. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from probabilistic signals; the absence of these is itself a data gap, not evidence of low risk. Exploitation status is therefore 'no public exploit identified at time of analysis.' The main factor that tempers overall severity is the limited blast radius: the vulnerability only discloses information (read access to restricted attachments) and cannot by itself modify or destroy data. Reported by VulnCheck and documented in an official vendor GHSA advisory, the technical facts are well-corroborated, but real-world exploitation volume is unknown and should be judged against the product's modest deployment footprint rather than assumed to be widespread.

An unauthenticated attacker who learns or guesses the page tag and attached file name of a read-restricted YesWiki page sends a direct request to the attachment download handler with those parameters. Because the handler fails to enforce the page's read ACL, the server returns the confidential attachment, leaking sensitive documents without any login. No public exploit code was identified, but the attack requires only a crafted HTTP GET and is trivial to reproduce.